From 2a72031a0efda3f3966cec04cd1a46f303e099d9 Mon Sep 17 00:00:00 2001 From: oleghasjanov Date: Thu, 6 Feb 2025 13:00:37 +0200 Subject: [PATCH] fix: remove SSL verification mode conditional in HTTP requester SECURITY NOTICE: This is a temporary fix. A proper solution should be implemented that maintains SSL verification in production environments. - Remove environment-based SSL verification mode check - Set verify_mode to VERIFY_NONE for all environments --- app/models/concerns/http_requester.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/app/models/concerns/http_requester.rb b/app/models/concerns/http_requester.rb index 4dd013c6a..4e573fdf7 100644 --- a/app/models/concerns/http_requester.rb +++ b/app/models/concerns/http_requester.rb @@ -62,11 +62,10 @@ def default_get_request_response(url:, body: nil, headers: nil) # :nocov: def basic_auth_get(url:, username:, password:) uri = URI(url) - verify_mode = Rails.env.development? || Rails.env.test? ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https', - verify_mode:) do |http| + verify_mode: OpenSSL::SSL::VERIFY_NONE) do |http| request = Net::HTTP::Get.new uri.request_uri request.basic_auth username, password response = http.request request